Master Linux Network Monitoring with iftop and nethogs: Installation, Commands, and Tips

Introduction

Many production services run on Linux servers, where network latency or stalls can occur. Monitoring per‑host traffic with tools like iftop and nethogs helps diagnose these issues.

iftop

iftop provides machine‑level traffic monitoring, showing real‑time bandwidth usage between the local host and remote hosts.

Installation yum install -y iftop After installation, start it with iftop. By default it monitors the first available network interface; you can specify an interface, e.g.: iftop -i eth0 The interface name can be obtained via ifconfig. The UI displays a ruler‑like scale at the top and a progress bar for each host.

Each pair of rows represents traffic in opposite directions for a host. Columns show source host, destination host, and average traffic over the last 2 s, 10 s, and 40 s. Sorting defaults to the 10 s average.

VM_0_9_centos => 169.254.0.4 3.19Kb 2.90Kb 3.17Kb
               <= 1.47Kb 1.480Kb 1.48Kb

Bottom statistics display cumulative (cumm), peak, and recent rates:

TX: cumm: 82.5KB peak: 67.3Kb rates: 5.02Kb 5.69Kb 16.0Kb
RX: cumm: 21.1KB peak: 10.1Kb rates: 1.74Kb 2.19Kb 3.99Kb
TOTAL: 104KB 77.4Kb 6.76Kb 7.88Kb 20.0Kb

Shortcut keys h or ? – show help n – toggle DNS resolution (show hostnames or IPs) s – display source hosts only d – display destination hosts only t – change traffic display mode (both, send only, receive only) N – toggle service name resolution S – show source ports D – show destination ports p – show ports 1 / 2 / 3 – sort by 2 s, 10 s, 40 s averages < – sort by source host > – sort by destination host o – freeze current sorting P – pause refresh b – toggle progress bar and ruler B – cycle bar display for 2 s/10 s/40 s T – show/hide total statistics j/k – scroll view f – edit filter code (pcap‑style filters) l – screen text search ! – execute a shell command q – quit

nethogs

nethogs monitors bandwidth usage per process.

Installation yum install -y nethogs Usage and options

nethogs [-v] [-h] [-b] [-d seconds] [-V] [-c count] [-t] [-p] [-s] [device ...]

Key flags: -V – print version -H – display help -B – BugHunt (tracing) mode -D – set refresh delay (default 1 s) -V – view mode (0=kb/s, 1=total kb, 2=total b, 3=total mb) -C – set update count (0 = unlimited) -P – sniff in promiscuous mode (not recommended) -S – sort by sent column -A – monitor all devices, including loopback

Device selection defaults to all active non‑loopback interfaces. Example commands:

# nethogs
# nethogs eth0 eth1

When multiple NICs are specified, each is monitored sequentially. To focus on a single NIC: # nethogs eth1 Interactive keys during runtime: q – quit S – sort by sent traffic R – sort by received traffic M – toggle between total and per‑second modes

Both tools provide valuable insight into network behavior on Linux servers, enabling quick identification of bandwidth hogs and problematic connections.